Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-89250 – Unauthenticated File Disclosure – WWBN AVideo (through commit c3edcc27)

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-89250 is a missing-authentication vulnerability in WWBN AVideo, an open-source video platform, that allows unauthenticated attackers to download recorded live-stream video files. The flaw resides in the getRecordedFile.php endpoint, which streams recorded FLV files without verifying that the requester is authorized to access them. The issue carries a CVSS v4.0 base score of 8.7 (High).

Technical details

  • Root cause: plugin/Live/standAloneFiles/getRecordedFile.php ships with a safety die statement commented out, so the script executes and serves files instead of refusing requests.
  • The script performs no authentication, session validation, or Live-owner token checks before opening and returning a file.
  • It sanitizes the requested filename to characters [0-9a-z_:-] but applies no authorization logic, so any value matching that character set is accepted.
  • Trigger condition: an attacker who knows or guesses a stream key can request the endpoint directly and have the corresponding recorded FLV file streamed back, including recordings from password-protected or private live streams.
  • Attack vector: Network — the endpoint is reachable over HTTP/HTTPS with no authentication required and no user interaction.
  • Impact: confidentiality loss — disclosure of recorded live-stream video content (DVR files stored under the server’s temporary directory); no impact to integrity or availability is indicated.

Affected software

  • WWBN AVideo — all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 in which line 3 of getRecordedFile.php remains commented out.

Severity

  • CVSS v4.0 Base Score: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • CVSS v3.1 Base Score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CWE-306: Missing Authentication for Critical Function

Mitigation and recommended actions

  • Immediate: No patched version has been released by the vendor at the time of advisory publication (September 11, 2026). Monitor the WWBN/AVideo repository for an update that fixes getRecordedFile.php and upgrade as soon as one is available.
  • Workaround: Restore the commented-out die statement on line 3 of plugin/Live/standAloneFiles/getRecordedFile.php to disable the script, or remove/block the file from being served.
  • Workaround: Do not deploy the helper script in an enabled state; if recording playback via this endpoint is required, place it behind authentication (e.g., require a valid Live owner token before the file is opened) at the application or reverse-proxy layer.
  • Restrict or block direct network access to getRecordedFile.php at the web server/reverse proxy/WAF level until a vendor fix is applied, especially for streams intended to be password-protected or private.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge